Edit tour

Linux Analysis Report
arm5.nn.elf

Overview

General Information

Sample name:	arm5.nn.elf
Analysis ID:	1629135
MD5:	3cb601105272bac375f0dab8671784b3
SHA1:	409fa6763b5ed0383861fa29e568ccf8896342d0
SHA256:	fd6968f8b317988de78e0bf3556e31cbab91aff0b84dab5cf00f6a40f45060f5
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1629135
Start date and time:	2025-03-04 12:18:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm5.nn.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/2@2/0

Runtime Messages

Command:	/tmp/arm5.nn.elf
PID:	5827
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

arm5.nn.elf (PID: 5827, Parent: 5753, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.nn.elf

arm5.nn.elf New Fork (PID: 5849, Parent: 5827)

arm5.nn.elf New Fork (PID: 5851, Parent: 5849)

udisksd New Fork (PID: 5838, Parent: 803)

dumpe2fs (PID: 5838, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 5896, Parent: 803)

dumpe2fs (PID: 5896, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm5.nn.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5827.1.00007f11ec017000.00007f11ec030000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm5.nn.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm5.nn.elf	Virustotal: Detection: 42%			Perma Link
Source: arm5.nn.elf	ReversingLabs: Detection: 50%

Source: global traffic

TCP traffic: 192.168.2.15:44056 -> 176.65.134.15:38242

Source: /tmp/arm5.nn.elf (PID: 5827)

Socket: 127.0.0.1:38242

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/2@2/0

Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5880/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5881/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5882/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5883/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5884/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5937/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5938/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5939/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5874/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5896/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5853/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5875/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5876/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5877/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5932/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5878/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5933/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5879/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5934/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5935/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5936/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5670/cmdline	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5870/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5871/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5872/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5873/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5948/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5885/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5940/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5886/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5941/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5865/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5942/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5866/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5943/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5867/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5944/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5868/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5945/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5869/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5946/status	Jump to behavior
Source: /tmp/arm5.nn.elf (PID: 5851)	File opened: /proc/5947/status	Jump to behavior

Source: /tmp/arm5.nn.elf (PID: 5827)

Queries kernel information via 'uname':

Jump to behavior

Source: arm5.nn.elf, 5827.1.00007fff4c8a7000.00007fff4c8c8000.rw-.sdmp	Binary or memory string: {U/tmp/qemu-open.kYeF6O
Source: arm5.nn.elf, 5827.1.0000557bcdd3a000.0000557bcde89000.rw-.sdmp	Binary or memory string: {U!/etc/qemu-binfmt/arm
Source: arm5.nn.elf, 5827.1.0000557bcdd3a000.0000557bcde89000.rw-.sdmp	Binary or memory string: {U/arm/ro10 /proc/1585/exe0!/usr/bin1/proc/803/exe/arm/usr/bin0!/usr/bin/VGAuthService1/usr/bin/xiccd/arm/sr10!/usr/bin/gnome-shell!/proc/724/exe1/proc/3469/exe/arm/ro10!/proc/1553/exe0!/usr/bin/vmtoolsd1/proc/3316/exe/arm/10!/proc/1514/exe0!/proc/740/exe1/usr/libexec/ibus-memconf
Source: arm5.nn.elf, 5827.1.0000557bcdd3a000.0000557bcde89000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: arm5.nn.elf, 5827.1.0000557bcdd3a000.0000557bcde89000.rw-.sdmp	Binary or memory string: /arm/usr/lib/systemd/systemd-udevdc/qemu-binfmt
Source: arm5.nn.elf, 5827.1.00007fff4c8a7000.00007fff4c8c8000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.kYeF6O
Source: arm5.nn.elf, 5827.1.0000557bcdd3a000.0000557bcde89000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm5.nn.elf, 5827.1.00007fff4c8a7000.00007fff4c8c8000.rw-.sdmp	Binary or memory string: ^x86_64/usr/bin/qemu-arm/tmp/arm5.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.nn.elf
Source: arm5.nn.elf, 5827.1.00007fff4c8a7000.00007fff4c8c8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm5.nn.elf, 5827.1.0000557bcdd3a000.0000557bcde89000.rw-.sdmp	Binary or memory string: c/qemu-binfmt
Source: arm5.nn.elf, 5827.1.00007fff4c8a7000.00007fff4c8c8000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: arm5.nn.elf, type: SAMPLE
Source: Yara match	File source: 5827.1.00007f11ec017000.00007f11ec030000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: arm5.nn.elf, type: SAMPLE
Source: Yara match	File source: 5827.1.00007f11ec017000.00007f11ec030000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm5.nn.elf	43%	Virustotal		Browse
arm5.nn.elf	50%	ReversingLabs	Linux.Backdoor.Mirai
arm5.nn.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.134.15	unknown	Germany		56325	DIOGELO-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
176.65.134.15	arm.nn.elf	Get hash	malicious	Mirai	Browse
	arm7.nn.elf	Get hash	malicious	Mirai	Browse
	sh4.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	na.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	bejv86.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	cbr.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	cbr.arc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	cbr.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	cbr.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	cbr.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIOGELO-ASGB	arm.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	arm7.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sh4.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/motd

Download File

Process:	/tmp/arm5.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	gorilla botnet is on the device ur not a cat go away.

/tmp/qemu-open.kYeF6O (deleted)

Download File

Process:	/tmp/arm5.nn.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.6168746059562227
Encrypted:	false
SSDEEP:	3:TggLLINln:Tgg2n
MD5:	50495054883CEDEB77CB4F8D068EEFF6
SHA1:	14317EF270AC6D985392169FD7D00554C0B194A5
SHA-256:	BFDA309B362AADA1D8538EC8D72FAB3463F75473508028B5392BB333059CC60C
SHA-512:	F16AB5F0651079E58F6865C7E6CE6511766F98F157ACA7525C4A9D0F7B118BE8368D92D538BCED6F99D6F0D23C2A93D56099A598ECF9EE46EDD743995DA0D016
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/arm5.nn.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.097982424718103
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm5.nn.elf
File size:	104'168 bytes
MD5:	3cb601105272bac375f0dab8671784b3
SHA1:	409fa6763b5ed0383861fa29e568ccf8896342d0
SHA256:	fd6968f8b317988de78e0bf3556e31cbab91aff0b84dab5cf00f6a40f45060f5
SHA512:	eb06b73d02a6201a8243e8b81d947b273cd9d748e6b14bd683f361e1431ab1d3f0163b367e50f62bd64850e987dba68595300f640e8983523f426eb3de5eac0d
SSDEEP:	1536:z16EkR+ebrQE6S9duRNREWXiG4KjrzK0pMhIM+cAA1HFDOxOV98:z1ZkRnXd2RNRE4Tjr20prA3/8
TLSH:	9CA33995FC865652C6D522B7FA6E42CC376713B8E3EB3202CD169F207B8A85B0E37541
File Content Preview:	.ELF...a..........(.........4...X.......4. ...(.....................X...X...............................Xj..........Q.td..................................-...L."....Z..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	103768
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x16a40	0x0	0x6	AX	16
.fini	PROGBITS	0x1eaf0	0x16af0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1eb04	0x16b04	0x1c54	0x0	0x2	A	4
.ctors	PROGBITS	0x29000	0x19000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x29008	0x19008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x29014	0x19014	0x504	0x0	0x3	WA	4
.bss	NOBITS	0x29518	0x19518	0x6540	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x19518	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x18758	0x18758	6.1821	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x19000	0x29000	0x29000	0x518	0x6a58	4.5541	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 420
• 38242 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 12:19:31.317441940 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:31.322484970 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:31.322577000 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:31.345580101 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:31.350610018 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:31.870305061 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:31.917390108 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:32.875364065 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:32.880328894 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:32.880428076 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:32.880428076 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:32.885476112 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:32.926054955 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:19:32.931874990 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:19:32.931955099 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:19:32.932040930 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:19:32.932180882 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:19:32.937053919 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:19:32.937134027 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:19:33.405390978 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:19:33.405492067 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:19:33.537986994 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:19:33.538069963 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:19:33.586127996 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:33.633377075 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:34.591240883 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:34.596291065 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:34.596390009 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:34.596390009 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:34.601545095 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:34.947005033 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:34.947127104 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:35.109302998 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:35.158483982 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:35.196472883 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:35.196603060 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:35.405491114 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:19:35.408349991 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:19:35.415496111 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:19:36.110934973 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:36.116002083 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:36.116069078 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:36.116125107 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:36.121125937 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:36.491002083 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:36.491069078 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:36.624130011 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:36.669433117 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:36.719554901 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:36.719621897 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:37.626101971 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:37.631169081 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:37.631228924 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:37.631256104 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:37.636254072 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:38.138410091 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:38.185394049 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:38.260498047 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:38.260595083 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:39.140080929 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:39.145220995 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:39.145298004 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:39.145325899 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:39.150985956 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:39.651694059 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:39.697393894 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:39.743132114 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:39.743196011 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:40.653244972 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:40.658296108 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:40.658386946 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:40.658386946 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:40.663444042 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:41.164264917 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:41.209403038 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:41.253993034 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:41.254163980 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:42.165637016 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:42.171062946 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:42.171185017 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:42.171209097 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:42.176878929 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:42.675705910 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:42.721596003 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:42.768795967 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:42.768862009 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:43.677150965 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:43.682154894 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:43.682214022 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:43.682240963 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:43.687211990 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:44.186832905 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:44.233412981 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:44.294996023 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:44.295064926 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:45.188067913 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:45.193105936 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:45.193213940 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:45.193264961 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:45.198225975 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:45.698158979 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:45.745419979 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:45.806066990 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:45.806221962 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:46.699446917 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:46.704556942 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:46.704623938 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:46.704637051 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:46.709626913 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:47.209016085 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:47.261421919 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:47.308295965 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:47.308413982 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:48.210131884 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:48.215112925 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:48.215198994 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:48.215212107 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:48.220235109 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:48.719842911 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:48.765403032 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:48.836100101 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:48.836194038 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:49.722543955 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:49.727615118 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:49.727684975 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:49.727696896 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:49.733129025 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:50.234863043 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:50.281447887 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:50.348428965 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:50.348587990 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:51.237191916 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:51.242278099 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:51.242373943 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:51.242374897 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:51.247457027 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:51.750022888 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:51.797446966 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:51.846975088 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:51.847043991 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:52.751427889 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:52.756531954 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:52.756612062 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:52.756666899 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:52.763684034 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:53.261265993 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:53.313450098 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:53.361609936 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:53.361726046 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:54.263005972 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:54.268178940 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:54.268234968 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:54.268273115 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:54.273293972 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:54.773530960 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:54.823565960 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:54.885008097 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:54.885109901 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:55.774986982 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:55.779973984 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:55.780105114 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:55.780124903 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:55.785847902 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:56.284786940 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:56.338164091 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:57.286140919 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:57.291234016 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:57.291347027 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:57.291362047 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:57.296390057 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:57.796488047 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:57.845520020 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:57.885736942 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:57.885845900 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:58.797573090 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:58.802660942 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:58.802738905 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:58.802768946 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:58.807729959 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:59.306498051 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:19:59.353470087 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:59.416786909 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:19:59.416867971 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:00.307601929 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:00.314757109 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:00.314836979 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:00.314884901 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:00.319883108 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:00.819252014 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:00.871248007 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:00.926587105 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:00.926661968 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:01.820661068 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:01.828531981 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:01.828600883 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:01.828638077 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:01.834574938 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:02.335459948 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:02.385505915 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:02.433581114 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:02.433651924 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:03.337059021 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:03.342093945 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:03.342264891 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:03.342295885 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:03.347270012 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:03.847429037 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:03.897485971 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:03.940232038 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:03.940304041 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:04.848612070 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:04.854028940 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:04.854093075 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:04.854121923 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:04.862605095 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:05.358058929 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:05.409514904 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:05.458583117 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:05.458672047 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:06.359550953 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:06.384845018 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:06.384942055 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:06.385088921 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:06.390542030 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:06.890489101 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:06.938247919 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:06.987189054 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:06.987265110 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:07.891827106 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:07.896852970 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:07.896935940 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:07.897025108 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:07.902056932 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:08.401309013 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:08.449534893 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:08.496653080 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:08.496721983 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:09.402445078 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:09.407542944 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:09.407615900 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:09.407630920 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:09.412729025 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:09.912242889 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:09.958391905 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:10.913665056 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:10.919416904 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:10.919482946 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:10.919533968 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:10.925436974 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:11.424096107 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:11.473579884 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:11.533987999 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:11.534090996 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:12.425353050 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:12.430387974 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:12.430464029 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:12.430485964 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:12.435589075 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:12.934653997 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:12.981755018 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:13.034226894 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:13.034317017 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:13.935745955 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:13.940849066 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:13.940922022 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:13.940938950 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:13.945997000 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:14.445611954 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:14.497550964 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:14.555258989 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:14.555356979 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:15.447423935 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:15.452517986 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:15.452601910 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:15.452650070 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:15.458405972 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:15.958067894 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:16.005588055 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:16.051479101 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:16.051573038 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:16.959606886 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:16.964699984 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:16.964761972 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:16.964778900 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:16.969816923 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:17.141473055 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:17.141532898 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:17.468518972 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:17.517554998 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:17.562782049 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:17.562848091 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:18.470103979 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:18.475105047 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:18.475172997 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:18.475210905 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:18.480257988 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:18.981147051 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:19.018435955 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:19.018558979 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:19.029546976 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:19.077605963 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:19.077708006 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:19.982661009 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:19.987741947 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:19.987831116 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:19.987889051 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:19.992932081 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:20.492646933 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:20.541857958 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:20.587069988 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:20.587187052 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:21.493793964 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:21.498909950 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:21.499067068 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:21.499067068 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:21.504127026 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:22.003344059 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:22.053576946 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:22.112668991 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:22.112827063 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:23.004803896 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:23.009975910 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:23.010041952 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:23.010092974 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:23.015114069 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:23.513758898 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:23.561563015 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:23.607083082 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:23.607161045 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:24.514929056 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:24.520040989 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:24.520112038 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:24.520143986 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:24.525122881 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:25.025057077 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:25.073576927 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:25.124346018 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:25.124454021 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:26.026518106 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:26.031625986 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:26.031718016 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:26.031737089 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:26.036767006 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:26.538130999 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:26.585583925 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:26.658021927 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:26.658119917 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:27.539499044 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:27.544565916 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:27.544621944 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:27.544651031 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:27.549716949 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:28.049870014 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:28.101640940 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:28.140876055 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:28.140940905 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:29.051511049 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:29.056603909 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:29.056659937 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:29.056694984 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:29.061666012 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:29.561027050 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:29.609613895 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:29.660305977 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:29.660370111 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:30.562643051 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:30.567687988 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:30.567780018 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:30.567863941 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:30.572876930 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:31.073698044 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:31.121680975 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:31.169085026 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:31.169209957 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:32.075047016 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:32.080246925 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:32.080379009 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:32.080403090 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:32.085644007 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:32.585001945 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:32.633738041 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:32.690376043 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:32.690681934 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:33.586766958 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:33.596860886 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:33.596932888 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:33.596997023 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:33.606491089 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:34.102343082 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:34.154879093 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:34.191390038 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:34.191473007 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:35.104226112 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:35.110332012 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:35.110416889 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:35.110471010 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:35.115531921 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:35.616645098 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:35.666464090 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:36.618320942 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:36.623500109 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:36.623584986 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:36.623630047 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:36.628690004 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:37.129776955 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:37.177794933 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:38.131511927 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:38.136643887 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:38.136775970 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:38.136805058 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:38.141964912 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:38.643326044 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:38.689711094 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:38.693039894 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:38.693152905 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:39.645071983 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:39.650221109 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:39.650312901 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:39.650372028 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:39.655466080 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:40.158467054 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:40.209712982 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:40.224711895 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:40.224884033 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:40.252793074 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:40.252994061 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:41.159888029 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:41.165062904 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:41.165118933 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:41.165148973 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:41.170245886 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:41.670939922 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:41.717725992 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:41.783839941 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:41.783966064 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:42.672645092 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:42.677769899 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:42.677859068 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:42.677916050 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:42.682949066 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:43.182600975 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:43.229762077 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:43.272098064 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:43.272207022 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:44.184483051 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:44.189476013 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:44.189563036 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:44.189620018 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:44.194663048 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:44.695461035 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:44.741684914 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:44.785736084 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:44.785881996 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:45.697103024 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:45.702289104 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:45.702347040 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:45.702385902 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:45.707391024 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:46.208767891 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:46.257720947 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:46.312732935 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:46.312932968 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:47.210191011 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:47.215361118 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:47.215413094 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:47.215442896 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:47.221499920 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:47.720810890 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:47.769742012 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:47.813123941 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:47.813237906 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:48.722414970 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:48.727498055 CET	38242	44160	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:48.727581024 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:48.727632046 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:48.732670069 CET	38242	44160	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:49.234074116 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:49.328741074 CET	38242	44160	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:49.328869104 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:50.235867023 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:50.241192102 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:50.241272926 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:50.241329908 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:50.246371984 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:50.748064041 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:50.797892094 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:50.839747906 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:50.839848042 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:51.750031948 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:51.755224943 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:51.755405903 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:51.755405903 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:51.760539055 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:52.262290955 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:52.313705921 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:52.352318048 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:52.352421999 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:53.264389992 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:53.269689083 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:53.269772053 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:53.269835949 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:53.274811029 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:53.775331020 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:53.825733900 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:53.889906883 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:53.890054941 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:54.777118921 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:54.782340050 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:54.782471895 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:54.782505989 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:54.788410902 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:55.288681030 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:55.341732025 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:55.383060932 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:55.383234978 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:56.290605068 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:56.295587063 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:56.295859098 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:56.295912981 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:56.300894976 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:56.802926064 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:56.849751949 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:56.901985884 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:56.902200937 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:57.804797888 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:57.811577082 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:57.811686039 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:57.811750889 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:57.816765070 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:58.317133904 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:58.365767002 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:58.413875103 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:58.413995981 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:59.319240093 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:59.324356079 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:59.324441910 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:59.324490070 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:59.331080914 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:59.482371092 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:59.482467890 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:59.831228971 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:20:59.877959967 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:59.936341047 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:20:59.936486959 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:00.833327055 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:00.838506937 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:00.838845968 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:00.838845968 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:00.844074011 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:01.345859051 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:01.393939972 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:01.436377048 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:01.436875105 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:02.347969055 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:02.353676081 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:02.353982925 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:02.354087114 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:02.359868050 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:02.862354994 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:02.913846970 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:02.958337069 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:02.958558083 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:03.864038944 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:03.869210958 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:03.869312048 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:03.869359016 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:03.874527931 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:04.377887964 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:04.426076889 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:04.469713926 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:04.469883919 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:05.379946947 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:05.384989023 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:05.385073900 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:05.385133028 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:05.390130997 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:05.891969919 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:05.937863111 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:05.991811037 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:05.991946936 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:06.894110918 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:06.899359941 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:06.899466991 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:06.899528027 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:06.904529095 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:07.410285950 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:07.461879015 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:07.513716936 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:07.513914108 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:08.412482023 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:08.417942047 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:08.418122053 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:08.418138981 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:08.423428059 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:08.924132109 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:08.969826937 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:09.018771887 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:09.018868923 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:09.926508904 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:09.933661938 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:09.933799028 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:09.933851957 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:09.938962936 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:10.441122055 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:10.493818045 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:11.443017960 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:11.448025942 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:11.448105097 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:11.448154926 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:11.453136921 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:11.954380035 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:12.001822948 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:12.059998989 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:12.060139894 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:12.956424952 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:12.961553097 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:12.961692095 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:12.961692095 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:12.966909885 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:13.467672110 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:13.513860941 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:13.570914030 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:13.571085930 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:14.470344067 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:14.475370884 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:14.475678921 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:14.475678921 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:14.480719090 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:14.982971907 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:15.029798985 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:15.079077005 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:15.079229116 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:15.985380888 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:15.990477085 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:15.990587950 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:15.990629911 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:15.995567083 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:16.498137951 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:16.545813084 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:16.588218927 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:16.588320971 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:17.500775099 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:17.505945921 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:17.506064892 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:17.506122112 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:17.511208057 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:18.012711048 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:18.057810068 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:19.014869928 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:19.019982100 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:19.020072937 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:19.020128012 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:19.025095940 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:19.527879953 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:19.577811003 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:19.619234085 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:19.619311094 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:20.530335903 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:20.535491943 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:20.535572052 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:20.535635948 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:20.540640116 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:21.043833017 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:21.089813948 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:21.131937981 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:21.132030964 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:22.046278954 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:22.051393986 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:22.051498890 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:22.051553011 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:22.056524038 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:22.559555054 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:22.605829954 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:23.562076092 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:23.567229033 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:23.567377090 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:23.567428112 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:23.572460890 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:24.075182915 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:24.121917009 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:24.170820951 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:24.171104908 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:25.077847004 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:25.082950115 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:25.083033085 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:25.083117962 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:25.088150024 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:25.591063023 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:25.641901970 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:25.679811954 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:25.679955006 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:26.592860937 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:26.597924948 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:26.598007917 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:26.598052025 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:26.603024960 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:27.102770090 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:27.102997065 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:27.104512930 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:27.149827957 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:27.202497959 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:27.202708006 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:28.106585979 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:28.112327099 CET	38242	44212	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:28.112468004 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:28.112507105 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:28.118480921 CET	38242	44212	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:28.619760990 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:28.665858030 CET	38242	44212	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:28.710284948 CET	38242	44212	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:28.710412025 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:29.621551037 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:29.627559900 CET	38242	44214	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:29.627823114 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:29.627886057 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:29.634377003 CET	38242	44214	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:30.133739948 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:30.181868076 CET	38242	44214	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:31.135207891 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:31.140373945 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:31.140438080 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:31.140472889 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:31.145543098 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:31.311177015 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:31.311316013 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:31.647181988 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:31.680870056 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:31.680941105 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:31.693867922 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:31.754729986 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:31.754826069 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:32.648978949 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:32.654146910 CET	38242	44218	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:32.654242039 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:32.654292107 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:32.659420967 CET	38242	44218	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:33.160666943 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:33.205979109 CET	38242	44218	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:34.162288904 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:34.167366028 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:34.167527914 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:34.167562008 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:34.172595024 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:34.673708916 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:34.728158951 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:34.773551941 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:34.773704052 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:35.675362110 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:35.680598974 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:35.680733919 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:35.680764914 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:35.685856104 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:36.187820911 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:21:36.234074116 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:36.284490108 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:21:36.284638882 CET	44222	38242	192.168.2.15	176.65.134.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 4, 2025 12:19:32.932040930 CET	192.168.2.15	8.8.8.8	0xd8c3	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 4, 2025 12:19:32.932180882 CET	192.168.2.15	8.8.8.8	0x74dd	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 4, 2025 12:19:33.537986994 CET	8.8.8.8	192.168.2.15	0xd8c3	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Mar 4, 2025 12:19:33.537986994 CET	8.8.8.8	192.168.2.15	0xd8c3	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: arm5.nn.elf PID: 5827, Parent PID: 5753

General

Start time (UTC):	11:19:30
Start date (UTC):	04/03/2025
Path:	/tmp/arm5.nn.elf
Arguments:	/tmp/arm5.nn.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: arm5.nn.elf PID: 5849, Parent PID: 5827

General

Start time (UTC):	11:19:30
Start date (UTC):	04/03/2025
Path:	/tmp/arm5.nn.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: arm5.nn.elf PID: 5851, Parent PID: 5849

General

Start time (UTC):	11:19:30
Start date (UTC):	04/03/2025
Path:	/tmp/arm5.nn.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: udisksd PID: 5838, Parent PID: 803

General

Start time (UTC):	11:19:30
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5838, Parent PID: 803

General

Start time (UTC):	11:19:30
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: udisksd PID: 5896, Parent PID: 803

General

Start time (UTC):	11:19:30
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5896, Parent PID: 803

General

Start time (UTC):	11:19:30
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm5.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/motd

/tmp/qemu-open.kYeF6O (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: arm5.nn.elf PID: 5827, Parent PID: 5753

General

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Linux Analysis Report
arm5.nn.elf